|
Details
|
|
Alert Id
|
90004-3 |
|
Alert Type
|
Passive Scan Rule |
|
Status
|
alpha |
|
Risk
|
Low |
|
CWE
|
16
|
|
WASC
|
14 |
Summary
Cross-Origin-Opener-Policy header is a response header that allows a site to control if others included documents share the same browsing context. Sharing the same browsing context with untrusted documents might lead to data leak.
Solution
Ensure that the application/web server sets the Cross-Origin-Opener-Policy header appropriately, and that it sets the Cross-Origin-Opener-Policy header to 'same-origin' for documents. 'same-origin-allow-popups' is considered as less secured and should be avoided. If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Opener-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-opener-policy).
References
Code
org/zaproxy/zap/extension/pscanrulesAlpha/SiteIsolationScanRule.java